Free CS0-003 Practice Test Questions and Answers (2026)

A discovery scan is a type of reconnaissance activity performed to map the structure and components of a target system or application. Its primary goal is to identify assets, enumerate directories, and understand the overall layout—precisely what the analyst is tasked with. This initial mapping allows the analyst to define the scope for a more focused vulnerability scan and to explicitly exclude sensitive URIs or directories from further, potentially disruptive, testing. This activity is a prerequisite to in-depth scanning, not the in-depth scan itself.

A. Uncredentialed scan: This describes the authentication context (scanning without login credentials), not the specific objective of mapping the application's structure.

C. Vulnerability scan: This is a more intensive scan that actively probes for known weaknesses, which the scenario states will occur after this initial mapping phase.

D. Credentialed scan: This describes scanning with authenticated user privileges to assess the internal attack surface, which is not the stated goal of the initial reconnaissance.

1. National Institute of Standards and Technology (NIST). (2008). Technical Guide to Information Security Testing and Assessment (Special Publication 800-115).

Section 3.2

"Discovery

" describes this phase as the start of testing

used to "identify systems and the information on them" and to "develop a map of the network." This directly supports the concept of scanning to understand where the scan will go.

2. CompTIA. (2022). CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives CS0-003.

Exam Objective 2.1

"Explain the importance of vulnerability management

" lists "Discovery" as a specific type of scan. This confirms its relevance and distinction from other scan types within the official exam curriculum.

3. Kruegel

C.

& Vigna

G. (2003). Anomalous Payload-Based Network Intrusion Detection. In Proceedings of the 5th International Symposium on Recent Advances in Intrusion Detection (RAID '02).

The paper

in its discussion of web application analysis

implicitly supports the concept of a discovery/crawling phase. Section 3

"Web Application Analysis

" describes the initial step as crawling the web application to "build a model of the application

" which is synonymous with a discovery scan's purpose of mapping URIs before deeper analysis. (Available via Springer or university libraries).

A formal incident declaration process is a critical component of an Incident Response Plan (IRP). Its most important function is to establish a clear, unambiguous line of authority. This ensures that only designated and qualified personnel can officially classify a security event as an incident, thereby triggering the allocation of significant organizational resources and initiating the formal response protocol. Without this documented authority, organizations risk delayed responses, confusion, premature or unnecessary escalations, and a general lack of control over the incident management lifecycle. This formal designation of authority is the cornerstone of an orderly and effective response.

A. To require that an incident be reported through the proper channels

This is incorrect because reporting channels are part of the initial detection and analysis phase, which precedes the formal declaration. The declaration process is what happens after an event has been reported.

C. To allow for public disclosure of a security event impacting the organization

This is incorrect because public disclosure is a communication task that occurs much later in the incident response process, if at all. The initial declaration is an internal trigger for the response team.

D. To establish the department that is responsible for responding to an incident

This is incorrect because the responsible department (e.g., CSIRT) and its roles are defined in the overarching Incident Response Plan, not within the specific procedure for declaration.

---

1. NIST Special Publication 800-61 Rev. 2

Computer Security Incident Handling Guide.

Section 2.3.2

"Policy

Plan

and Procedure Creation": This section emphasizes the need for a formal incident response policy that defines roles

responsibilities

and levels of authority. It states

"The incident response policy should also state which individuals have the authority to... declare an incident." This directly supports that identifying authority is a primary goal of formalizing the process.

2. Carnegie Mellon University

Software Engineering Institute (SEI)

Defining Incident Management Processes

CERT/CC

October 2018.

Section 3.2

"Declare an Incident": This document outlines the incident management process and states

"The goal of this step is to make a decision about whether the event should be declared an incident... This decision is usually made by an incident response team leader or manager." This highlights that the declaration is a formal decision point made by an authorized individual.

3. ISO/IEC 27035-1:2023

Information technology — Information security incident management — Part 1: Principles and process.

Section 7.3

"Decision and declaration": This international standard specifies that the incident management process must include a formal decision step. It states that criteria for declaring an incident should be established and that "the decision to declare an information security incident should be taken by a competent and authorized person or team." This reinforces the centrality of designated authority in the declaration process.

:

The primary differentiator for prioritization among the given options is the Attack Vector (AV) metric within the CVSSv3 string. The AV:N (Network) vector indicates that the vulnerability is exploitable remotely from the internet. This represents the broadest attack surface and the highest immediate risk, as an attacker requires no prior access to the local or adjacent network. When other metrics like Attack Complexity (AC:L), Privileges Required (PR:L), and Impact (C:H/I:H/A:H) are identical, the vulnerability that can be exploited from anywhere on the network should always be remediated first.

A. AV:P (Physical) requires physical access to the target system, representing the lowest level of risk and therefore the lowest priority for remediation.

B. AV:A (Adjacent) requires the attacker to be on the same local network, which is a more limited attack surface than a network-exploitable vulnerability.

D. AV:L (Local) requires the attacker to have existing access to the system, making it a lower priority than a remotely exploitable vulnerability.

1. FIRST.org

Inc. (2019). Common Vulnerability Scoring System v3.1: Specification Document. Section 2.1.1

Attack Vector (AV). The document states

"The Base Score is highest for a vulnerability that can be exploited remotely (AV:N)... This is because the attacker does not require any local or physical access to the vulnerable component." This directly supports prioritizing AV:N.

2. Mell

P.

& Scarfone

K. (2005). The Common Vulnerability Scoring System (CVSS) and Its Applicability to Federal Agency Systems (NISTIR 7435). National Institute of Standards and Technology. Section 3.1

"Base Metrics

" discusses how the Attack Vector metric captures the context by which vulnerability exploitation is possible

with Network being the most critical.

3. Purdue University. CS 42600: Computer Security

Lecture 18 - Vulnerabilities. Course materials discuss vulnerability analysis and CVSS. The lectures emphasize that the Attack Vector is a critical component for prioritization

with network-based vectors (AV:N) posing a significantly higher risk than local

adjacent

or physical vectors due to the vast number of potential remote attackers.

The primary objective is to implement compensating controls to contain an active adversary on a live system while maintaining critical functionality. Deploying an Endpoint Detection and Response (EDR) solution provides deep visibility into system activities and allows responders to actively block or disrupt malicious processes, thereby reducing the adversary's capabilities without taking the server offline. Concurrently, using microsegmentation allows for the creation of granular, stateful firewall policies that restrict network connectivity to only what is explicitly required—in this case, the connection from the web server to the database server on a specific port. This network-level control effectively contains the adversary, preventing lateral movement to other parts of the network while preserving the necessary service connections.

A. Dropping the tables on the database server is a destructive action that violates the requirement to keep the service functional and results in data loss.

C. Stopping the httpd service would make the web application inaccessible, directly contradicting the requirement to keep the web service running and accessible.

E. Commenting out the HTTP account in /etc/passwd would disable the service account, causing the web server process to fail and violating the accessibility requirement.

F. Moving the database to the already compromised web server would be a major architectural change that increases risk by consolidating assets on a compromised host.

1. National Institute of Standards and Technology (NIST). (2012). Special Publication 800-61 Rev. 2

Computer Security Incident Handling Guide.

Section 3.3.3

Containment

p. 27: This section outlines containment strategies

which include isolating affected hosts or network segments. Microsegmentation is a modern implementation of network segmentation that creates "secure zones in data centers and cloud deployments that allow companies to isolate workloads from one another and secure them individually." This directly supports option D as a containment strategy.

2. Souppaya

M.

& Scarfone

K. (2013). NIST Special Publication 800-128

Guide for Security-Focused Configuration Management of Information Systems.

Section 4.3

Isolate

p. 21: Discusses isolation as a security technique. "Isolation may be implemented through physical or logical separation... Logical separation can be accomplished through a variety of mechanisms

such as access control lists (ACLs) on routers and firewalls..." Microsegmentation is an advanced form of logical separation

aligning with this principle for containment (Option D).

3. Al-Shaer

E.

& Wei

J. (2021). Modeling and Verification of Micro-segmentation for Zero-Trust Security. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security (pp. 3215–3217).

Abstract & Section 1: The paper describes microsegmentation as a key enabler for a Zero-Trust security model

which "enforces strict access control and network segmentation to prevent lateral movement." This directly supports the use of microsegmentation (Option D) to contain an adversary.

DOI: https://doi.org/10.1145/3460120.3485373

4. Boicea

A.

et al. (2018). EDR

EPP

and NGAV: The new triple-threat in endpoint security. 2018 10th International Conference on Electronics

Computers and Artificial Intelligence (ECAI).

Section II.A

Endpoint Detection and Response (EDR): This section describes EDR as a solution that "records system activities and events taking place on endpoints... and provides forensic analysis and remediation capabilities to identify and stop attacks." This capability to actively reduce an adversary's actions supports Option B.

DOI: https://doi.org/10.1109/ECAI.2018.8679018

The most effective method for safeguarding Personally Identifiable Information (PII) during an incident investigation is to combine technical controls with administrative controls. Encrypting the data (a technical control) protects it from unauthorized access if the storage medium is compromised. Simultaneously, limiting permissions within the investigation team (an administrative control) adheres to the principle of least privilege, ensuring that only authorized personnel with a direct need-to-know can access the sensitive data. This dual approach minimizes the risk of accidental exposure or insider threats while still enabling the investigation to proceed.

A. "Close the data so only the company has access" is overly broad and insecure, as it does not implement the principle of least privilege within the organization.

C. Creating a data deletion procedure is a crucial part of data lifecycle management but is not the most immediate or primary action for safeguarding data during an active incident.

D. "Permissions are open only to the company" is not a security control; it implies a lack of internal access controls and violates the principle of least privilege.

---

1. National Institute of Standards and Technology (NIST) Special Publication 800-122

Guide to Protecting the Confidentiality of Personally Identifiable Information (PII).

Section 4.4

"Restrict PII Access

" states

"Organizations should restrict access to PII to only those individuals who have a need to know... This is often referred to as the principle of least privilege." (Page 29).

Section 4.5

"Protect PII at Rest and in Transit

" recommends

"Organizations should consider using encryption to protect the confidentiality of PII... PII should be encrypted when it is stored (at rest)..." (Page 30). This directly supports combining limited permissions and encryption.

2. National Institute of Standards and Technology (NIST) Special Publication 800-61 Rev. 2

Computer Security Incident Handling Guide.

Section 3.2.5

"Handling

" discusses the importance of protecting evidence and sensitive data during an investigation. It states

"Handling of data should be performed according to the policies and procedures that were established in the preparation phase... This includes... protecting sensitive information." (Page 31). This implies that pre-defined controls like access limitation and encryption should be applied.

3. MIT OpenCourseWare

6.858 Computer Systems Security

Fall 2014.

Lecture 1

"Introduction; Threat models

" introduces the core security principles of confidentiality

integrity

and availability. The lecture materials emphasize that confidentiality is often enforced through a combination of access control mechanisms and encryption

which aligns directly with the correct answer. (Available at ocw.mit.edu).

The threat actor's actions of compiling, testing, and modifying a malicious downloader to evade specific security controls fall directly into the Weaponization stage of the Cyber Kill Chain. This stage is defined by the creation or modification of a malicious payload (the "weapon") that is tailored to the target environment. The actor is using intelligence gathered during reconnaissance to build an effective tool for the subsequent stages of the attack. The primary activity described is the creation of the malicious artifact, not its delivery or execution.

A. Delivery: This stage involves transmitting the weapon to the target (e.g., via a phishing email or a malicious website), which has not yet occurred in the scenario.

B. Reconnaissance: This stage focuses on gathering information about the target. While the actor used intelligence, the core action described is building the tool, not gathering the data.

C. Exploitation: This stage involves triggering the malicious code on the victim's system to gain access. The actor is still in the preparation phase on their own systems.

1. Hutchins

E. M.

Cloppert

M. J.

& Amin

R. M. (2011). Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains. Lockheed Martin Corporation. In Section 3

"Stage 2: Weaponization

" the authors state

"Weaponization...couples a remote access trojan with an exploit into a deliverable payload." This directly aligns with creating a malicious downloader.

2. NIST. (2016). NIST Special Publication 800-150: Guide to Cyber Threat Information Sharing. National Institute of Standards and Technology. Section 2.3.1 describes the Cyber Kill Chain

where Weaponization is the stage for creating the malicious payload before the Delivery stage.

3. SANS Institute. (2015). The Sliding Scale of Cyber Security. SANS Technology Institute. Page 5 describes the kill chain stages

defining Weaponization as the point where an attacker "chooses a weapon...and packages it for delivery." The act of compiling and testing fits this definition.

Risk transfer is a risk management strategy that involves shifting the financial consequences of a potential loss to a third party. Purchasing cyber insurance is a classic example of this principle. The organization pays a premium to an insurance company, which in turn agrees to cover the financial damages resulting from a specified cyber incident (e.g., data breach, ransomware attack). This action does not eliminate or reduce the likelihood of the risk itself but transfers the associated financial burden from the organization to the insurer.

A. Accept: Risk acceptance involves acknowledging a risk and making a deliberate decision to take no action, bearing any potential losses. Purchasing insurance is an active response, not acceptance.

B. Avoid: Risk avoidance means eliminating the risk by ceasing the activity that creates it (e.g., disconnecting a system from the internet). Insurance manages the consequences, it does not avoid the activity.

C. Mitigate: Mitigation involves implementing controls (e.g., firewalls, encryption, training) to reduce the likelihood or impact of a risk. Insurance is a financial tool, not a technical or procedural control.

1. National Institute of Standards and Technology (NIST). (2011). Special Publication (SP) 800-39

Managing Information Security Risk: Organization

Mission

and Information System View.

Section 2.3

Page 10: This document outlines the four fundamental risk response strategies. It explicitly defines risk sharing/transfer as a method "to shift risk from one group or individual to another (e.g.

by using insurance)."

2. National Institute of Standards and Technology (NIST). (2020). NISTIR 8286

Integrating Cybersecurity and Enterprise Risk Management (ERM).

Section 2.3.2

Page 13: In the discussion on Risk Response

this publication lists "Transferring (or sharing) risk to another party

such as through insurance" as a primary risk response option.

3. Peyton

E. (2006). Lecture 15: Risk Management. 1.040/1.401 Project Management

Fall 2006. Massachusetts Institute of Technology: MIT OpenCourseWare.

Slide 14

"Risk Response Planning": This university course material identifies four strategies for negative risks. It defines "Transfer" as shifting the risk and its consequences to a third party and lists "Insurance" as the prime example of this strategy.

The foundational step in a risk-based approach to cybersecurity is asset management, which begins with identifying and valuing assets. To categorize and prioritize systems for protection based on the sensitivity of their content (confidentiality, integrity, and availability), a security analyst must first determine the value of each asset. This valuation dictates the level of security controls required and guides all subsequent risk management activities, such as vulnerability scanning and control implementation. Without understanding the asset's value, it is impossible to appropriately prioritize security efforts or justify the cost of protective measures.

A. Interviewing users is a useful data-gathering step, but it does not establish the authoritative business value or impact, which is necessary for formal categorization.

B. Scanning for vulnerabilities is a subsequent step in risk assessment. The criticality of a vulnerability is determined by its potential impact on a valued asset.

C. Configuring alerts is a proactive security control. This action is typically performed after systems have been categorized and appropriate security baselines have been established.

1. National Institute of Standards and Technology (NIST) Special Publication 800-30

Revision 1

Guide for Conducting Risk Assessments. Section 2.2

"Conduct Assessment

" outlines the process which begins with identifying assets and their value to determine the impact of a loss of confidentiality

integrity

or availability. Specifically

Task 2-3

"Determine impact

" relies on the value of the system and data.

2. Federal Information Processing Standards (FIPS) Publication 199

Standards for Security Categorization of Federal Information and Information Systems. Section 3

"Security Categorization

" states

"The first step in the security categorization process is to identify the information types processed

stored

or transmitted by the information system." This process is directly tied to determining the value and sensitivity of the information asset to establish a security category.

3. Purdue University

Information Security Risk Management (CS 52600) Courseware. The risk management lifecycle taught in this program begins with "Asset Identification and Valuation

" establishing it as the prerequisite step before threat analysis or vulnerability assessment. This is a standard model in academic cybersecurity curricula.

Security Orchestration, Automation, and Response (SOAR) platforms are designed to integrate disparate security tools and automate workflows. The primary mechanism for enabling a SOAR platform to communicate with, command, and control tools from different vendors is through Application Programming Interfaces (APIs). APIs provide a standardized programmatic interface that allows the SOAR solution to send instructions (e.g., "block this IP on the firewall," "isolate this endpoint with the EDR") and retrieve data from various security products, thereby orchestrating actions across the entire security stack.

A. STIX/TAXII: These are standards for formatting and transporting threat intelligence data, not for executing commands or actions on security platforms.

C. Data enrichment: This is a process where a SOAR platform augments initial alert data with more context; it is a function, not the technology used for cross-platform control.

D. Threat feed: A threat feed is a source of threat intelligence data that a SOAR platform consumes. It does not provide the mechanism to automate actions on other tools.

1. National Institute of Standards and Technology (NIST). (2022). Security Orchestration

Automation

and Response (SOAR) and the Security Operations Center (SOC) (NISTIR 8362). In Section 2.2

"SOAR Capabilities

" the document states

"SOAR platforms integrate with other security tools and systems through APIs... This integration allows the SOAR platform to collect data from and send commands to the other tools."

2. Carnegie Mellon University Software Engineering Institute (SEI). (2019). A Look at SOAR (Security Orchestration

Automation

and Response). The publication notes that a key feature of SOAR is its ability to "integrate with other security tools through application programming interfaces (APIs)." This integration is what enables the orchestration and automation of security tasks.

3. SANS Institute. (2019). SOAR: A Practitioner's Guide to Security Orchestration

Automation

and Response. This guide explains that the core of SOAR's integration capability relies on APIs

referring to them as the "connective tissue" that allows the SOAR platform to interact with and control a diverse set of security tools for automated response actions. (p. 5).

When communicating an incident to the general public, an incident manager must collaborate with specialized teams to ensure the message is both legally sound and effectively managed. The Legal department is critical for reviewing all external communications to ensure compliance with data breach notification laws and to mitigate legal liability. The Public Relations department is responsible for crafting the message, managing media inquiries, and preserving the organization's reputation. This dual-pronged approach ensures that public statements are accurate, compliant, and strategically delivered to maintain public trust.

A. Law enforcement: Law enforcement is an external agency to be notified if a crime has occurred, not an internal entity that approves the organization's public communication process.

B. Governance: Governance provides the high-level framework and policies, but the specific, operational task of crafting and approving public statements falls to legal and PR teams.

D. Manager: This option is too vague. The incident manager is a manager who coordinates with other specific functional leads, such as the heads of legal and public relations.

F. Human resources: Human resources primarily handles internal communications and personnel-related matters, not external communications with the general public regarding a security incident.

1. National Institute of Standards and Technology (NIST). (2012). Special Publication 800-61 Rev. 2

Computer Security Incident Handling Guide.

Section 2.4.3

"Relationships with Other Groups

" states

"The CSIRT should also have a close relationship with the organization’s general counsel and public affairs offices. The general counsel can provide advice on legal issues... Public affairs can handle the media

which is particularly important during a high-profile incident." This directly supports the involvement of Legal (general counsel) and Public Relations (public affairs).

2. University of Washington. (2023). UW-IT Information Security and Privacy: Incident Response Plan.

Section "Incident Response Team

" under the subsection for "External Communications

" explicitly lists "University Marketing & Communications" (the public relations function) and the "Office of the Attorney General" (the legal function) as the primary entities responsible for coordinating and approving communications with the media and the public.

3. Solove

D. J.

& Citron

D. K. (2017). Risk and Anxiety: A Theory of Data-Breach Harms. The George Washington University Law School Public Law and Legal Theory Paper No. 2017-10.

Section IV.B

"The Response to a Data Breach

" discusses the institutional response

emphasizing that "companies often hire public relations firms to help them manage the crisis" and that legal counsel is central to navigating the complex web of state and federal notification laws. This academic source underscores the essential roles of both PR and legal teams. (Available via SSRN and university repositories).

The security audit's purpose is to identify unsecured network services. Based on the provided list, FTP (File Transfer Protocol) on port 21 and Telnet on port 23 are inherently insecure. Both of these legacy protocols transmit all data, including usernames and passwords, in cleartext across the network. This allows any attacker with the ability to monitor network traffic (e.g., via a man-in-the-middle attack) to easily capture and read sensitive information. Therefore, their presence represents a significant security vulnerability that requires immediate investigation and remediation, typically by replacing them with secure alternatives like SFTP and SSH, respectively.

B. 22: SSH (Secure Shell) is a secure protocol that provides strong encryption for all transmitted data, including credentials, making it the secure replacement for Telnet.

D. 636: LDAPS (Lightweight Directory Access Protocol Secure) is the secure version of LDAP, using SSL/TLS to encrypt communications. The unsecured version runs on port 389.

E. 1723: While PPTP (Point-to-Point Tunneling Protocol) is considered insecure due to known cryptographic vulnerabilities, FTP and Telnet are more fundamentally unsecured as they lack any encryption whatsoever.

F. 3389: Modern RDP (Remote Desktop Protocol) is a secure protocol that encrypts remote administration sessions, especially when Network Level Authentication (NLA) is enabled.

---

1. National Institute of Standards and Technology (NIST)

Special Publication 800-53 Revision 5

Security and Privacy Controls for Information Systems and Organizations

September 2020. In control family SC (System and Communications Protection)

control SC-8(1) "Cryptographic Protection" mandates the use of validated cryptography for data in transit. Protocols like Telnet and FTP do not meet this requirement as they transmit data in cleartext. (See control SC-8

Page 229).

2. Internet Engineering Task Force (IETF)

RFC 4217

Securing FTP with TLS

October 2005. The introduction (Section 1

Page 2) explicitly states

"The File Transfer Protocol [FTP] ... is weak with respect to security as it sends all passwords and data in the clear." This highlights the inherent insecurity of the standard FTP protocol.

3. Purdue University

CS 42600: Computer Security Courseware

"Lecture 18: Network Security". This and similar university course materials consistently identify Telnet and FTP as canonical examples of insecure protocols that operate in cleartext and should be replaced by secure alternatives like SSH and SFTP. (Specific lecture notes often detail the packet structure showing cleartext credentials).

The observed pattern of regular, periodic, outgoing HTTPS connections from a server to a single public IP address is a classic indicator of Command and Control (C2) beaconing. Malware on the compromised server establishes these connections to "call home" to its controller, receive instructions, or signal its operational status. Using a common protocol like HTTPS on port 443 is a technique used by adversaries to blend malicious traffic with legitimate network activity, making it harder to detect. The "around the clock" nature of the connections reinforces the automated, persistent nature of a C2 beacon.

B. Data exfiltration: This typically involves large or sustained data transfers, not the regular, repeating "heartbeat" pattern described in the scenario.

C. Anomalous activity on unexpected ports: The activity uses HTTPS (port 443), which is a very common and expected port for network traffic, not an unexpected one.

D. Network host IP address scanning: Scanning involves sending probes to many different IP addresses, whereas this activity is directed toward a single, specific public IP.

E. A rogue network device: The traffic originates from a known data-center server, which is a managed asset, not an unauthorized or unknown device on the network.

1. MITRE ATT&CK® Framework. (2023). Technique T1071: Application Layer Protocol. MITRE. Retrieved from https://attack.mitre.org/techniques/T1071/

Reference Detail: Sub-technique T1071.001 (Web Protocols) states

"Adversaries may communicate using HTTP and HTTPS to command and control victim systems... C2 traffic is often camouflaged as normal web traffic to avoid detection." This directly supports the use of HTTPS for C2 communications.

2. NIST Special Publication 800-61 Rev. 2. (2012). Computer Security Incident Handling Guide. National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-61r2

Reference Detail: Section 2.3.3

"Sources of Precursors and Indicators

" discusses how network traffic analysis can reveal indicators of compromise. An unexpected outbound connection from a server

especially one with a regular pattern

is a strong indicator of a compromised host

consistent with C2 activity.

3. SANS Institute Reading Room. (2016). Beats on the Wire: A Security Analysis of Command and Control. SANS Technology Institute.

Reference Detail: Page 6 discusses C2 beaconing

stating

"A beacon is a periodic outbound connection attempt from a compromised host to a command and control server... The beaconing interval can be configured to be anything from seconds to days." This describes the exact behavior observed.

The MITRE ATT&CK® framework is best described as a globally accessible, curated knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. Its primary purpose is to serve as a foundation for threat modeling and methodology, enabling organizations to track and better understand adversary behaviors. It is an open-source project that is continuously updated and evolves with contributions from the global cybersecurity community, ensuring it remains relevant against emerging threats. This dynamic nature is a defining characteristic of the framework.

A. This describes application security testing (AST) methodologies like SAST or DAST. While ATT&CK can inform such tests, it is not a testing method itself.

B. This is a better description of an Information Sharing and Analysis Center (ISAC) or a threat intelligence platform (TIP), which focus on the sharing and dissemination of intelligence.

C. This describes a primary use case or outcome of applying the ATT&CK framework, rather than describing the fundamental nature of the framework itself, which is a knowledge base.

E. This accurately describes the Lockheed Martin Cyber Kill Chain®, which models an intrusion as a linear sequence of phases, unlike the ATT&CK matrix, which is non-sequential.

1. The MITRE Corporation. (2023). About ATT&CK. MITRE ATT&CK®. Retrieved from https://attack.mitre.org/resources/getting-started/. In the "What is ATT&CK?" section

it is defined as "a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations." This supports the "tracks and understands threats" aspect. The community-driven and evolving nature is also a central theme.

2. NIST. (2021). Special Publication 800-160

Volume 2

Revision 1: Developing Cyber-Resilient Systems: A Systems Security Engineering Approach. National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-160v2r1. In Appendix F

Section F.3

ATT&CK is described as a "curated knowledge base and model for cyber adversary behavior" used to "characterize and describe adversary behaviors." This aligns with the concept of a tool to track and understand threats.

3. Applebaum

A. (2020). A Survey of the MITRE ATT&CK Framework. SANS Institute Reading Room. Retrieved from https://www.sans.org/white-papers/39390/. On page 4

the paper states

"The ATT&CK framework is a knowledge base of adversary behavior and a model for describing the actions an adversary may take... It is a living

community-driven knowledge base that is continuously updated..." This directly supports the description of an evolving

open project for understanding threats.

The primary purpose of implementing a Secure Software Development Life Cycle (SSDLC) is to integrate security practices into every phase of software development, from requirements gathering to deployment and maintenance. This proactive "shift-left" approach systematically reduces the number of vulnerabilities in the final product, thereby decreasing the operational and business risks associated with its usage. Furthermore, many industries are subject to stringent regulatory and compliance frameworks (e.g., PCI DSS, HIPAA, GDPR) that mandate secure software development practices. Adhering to an SSDLC is a critical mechanism for demonstrating and achieving compliance with these legal and industry requirements.

A. The primary goal of an SSDLC is risk reduction and security assurance, not to serve as a marketing tool to justify price increases.

C. An SSDLC integrates with agile processes but typically increases the scope and frequency of security testing throughout the lifecycle, rather than decreasing it.

D. An SSDLC fosters a culture of shared responsibility for security (DevSecOps), embedding it within the development team, not transferring it to another team.

1. National Institute of Standards and Technology (NIST). (2022). Special Publication (SP) 800-218 V1.1

Secure Software Development Framework (SSDF): Recommendations for Mitigating the Risk of Software Vulnerabilities.

Section 1

Introduction

Paragraph 2: "The SSDF’s goal is to reduce the number of vulnerabilities in released software

mitigate the potential impact of the exploitation of undetected or unaddressed vulnerabilities

and address the root causes of vulnerabilities to prevent recurrences." This directly supports the risk reduction aspect of the correct answer.

2. OWASP Foundation. (n.d.). OWASP Software Assurance Maturity Model (SAMM) v2.0.

Section

Business Functions

Governance (G)

Paragraph 1: "The Governance function is responsible for managing the organization’s software development life cycle. It includes activities related to strategy

metrics

policy

compliance

and education." This highlights the role of an SSDLC in meeting compliance requirements.

3. Mead

N. R. (2005). Security Quality Requirements Engineering (SQUARE) Methodology. Carnegie Mellon University

Software Engineering Institute. CMU/SEI-2005-TR-009.

Page 1

Abstract: "Building secure software is a difficult problem... Failure to do so can result in serious vulnerabilities

leading to loss of money

life

and national security... This report describes the Security Quality Requirements Engineering (SQUARE) methodology... for eliciting

categorizing

and prioritizing security requirements for information technology systems and applications." This academic source establishes the direct link between secure development processes and mitigating risks from vulnerabilities.

The installation of a new EDR solution has led to a significant increase in alerts, causing alert fatigue and overwhelming the security team. To manage this, the organization needs to centralize the aggregation of these alerts and automate the response process.

A SIEM (Security Information and Event Management) system is the primary tool for centralizing security data. It aggregates logs and alerts from various sources, including the new EDR, into a single platform. This allows analysts to correlate events, reduce false positives, and prioritize threats from a unified viewpoint.

A SOAR (Security Orchestration, Automation, and Response) platform complements the SIEM by automating the remediation workload. It uses predefined "playbooks" to execute response actions automatically, such as isolating an endpoint or blocking an IP address, which directly reduces the manual effort required by analysts.

C. MSP: A Managed Service Provider is an external service that would outsource the workload, not provide a tool to help the internal team centralize it.

D. NGFW: A Next-Generation Firewall is a network security device that is a source of security alerts, not a tool for centralizing and managing alerts from other systems.

E. XDR: While Extended Detection and Response centralizes data, it is typically a more integrated, often single-vendor, evolution of EDR. A SIEM is the classic, vendor-agnostic solution for centralizing data from disparate sources, which is the immediate need.

F. DLP: Data Loss Prevention is a specific security control designed to prevent data exfiltration; it would add to the alert volume rather than help manage it.

1. NIST (National Institute of Standards and Technology). (2021). NISTIR 8334 (Draft) - A Response to the Challenge of Finding and Fixing Vulnerabilities. Section 2.2

"Security Orchestration

Automation

and Response (SOAR)

" describes SOAR as a solution to "reduce the burden on security practitioners" by automating "time-consuming

manual

and repetitive tasks." This directly addresses the increased workload.

2. NIST. (2006). SP 800-92 - Guide to Computer Security Log Management. Section 4.3

"Log Management Infrastructures

" discusses the centralization of logs for analysis. It states

"Centralized logging permits the correlation of events among several systems

" which is the core function of a SIEM in addressing a high volume of alerts from sources like an EDR.

3. Carnegie Mellon University. (2017). The 2017 SEI Cyber Intelligence Research Agenda. Section 3.2.2

"Security Orchestration

" discusses the need for tools that "integrate information from a variety of sources (e.g.

SIEMs

threat intelligence platforms...)" and "automate and assist with the response

" highlighting the synergistic roles of SIEM and SOAR. (Document CMU/SEI-2017-SR-001).

4. Suh

B.

& Lee

H. (2021). A Study on the Method of Building an Intelligent Security Control System Using SOAR. Journal of The Korea Institute of Information Security & Cryptology

31(1)

139-150. This academic paper explains that SOAR platforms are introduced to handle the "increasing security threats and alerts" by integrating with SIEMs to automate response procedures

which is the exact scenario described. (DOI: https://doi.org/10.13089/JKIISC.2021.31.1.139).

Dynamic Application Security Testing (DAST) exercises a running application with crafted inputs and analyzes the responses to uncover runtime‐layer flaws such as SQL injection, file-path inclusion (FRI), and cross-site scripting (XSS). Because it is performed throughout development and before production release, it supports the “security-by-design” objective of identifying and remediating vulnerabilities early in the software development life cycle.

A. Reverse engineering – Focuses on dissecting compiled binaries (often third-party or malicious code) rather than proactively finding vulnerabilities in software the organization is developing.

B. Known environment testing – Not an established security-testing methodology; offers no systematic process for detecting web-application vulnerabilities like injection or XSS.

D. Code debugging – Aims to correct logic or syntax errors; it lacks the automated attack simulation and vulnerability signatures required to expose security flaws such as SQLi or XSS.

1. NIST SP 800-115

“Technical Guide to Information Security Testing and Assessment

” §4.6.1 Dynamic Testing

pp. 4-7–4-9 – describes using dynamic analysis to detect SQLi

XSS

and file-inclusion flaws.

2. NIST SP 800-218 Rev.1

“Secure Software Development Framework

” Practice PO.3.3 & PO.4.2 – mandates dynamic analysis during development to identify injection and scripting vulnerabilities.

3. MIT OpenCourseWare 6.858 (Computer Systems Security)

Lecture 4 slides 34-36 – presents DAST tools (e.g.

Burp

ZAP) for finding runtime web-application flaws such as SQLi and XSS.

The scenario describes adversaries using "Living-off-the-Land" (LotL) techniques, where they leverage legitimate, native system tools (e.g., PowerShell, WMI) for malicious activities like privilege escalation. The most direct and effective control against this is application control. By implementing policies to block the execution of untrusted applications or, more granularly, restricting how trusted applications can be run (e.g., preventing Office applications from spawning PowerShell), an organization can directly disrupt the adversary's ability to use these native tools for malicious purposes. This approach, often implemented via application allowlisting, specifically targets the execution of unauthorized code, which is the core of the described threat.

A. Disabling administrative accounts is operationally infeasible, as these accounts are required for legitimate system administration and maintenance tasks.

B. MFA is an authentication control that is most effective at preventing unauthorized access, not at stopping post-compromise activities like local privilege escalation.

C. While system hardening is a valuable practice, adversaries are using core, necessary tools, which typically cannot be disabled or removed without impacting system functionality.

1. MITRE ATT&CK® Framework: The technique T1548

"Abuse Elevation Control Mechanism

" describes adversaries using system features to elevate privileges. The primary listed mitigation is M1048

"Application Control

" which states: "Use application control to prevent the execution of malicious commands and scripts that may be used to abuse elevation control mechanisms." This directly aligns with blocking the execution of untrusted applications. (Source: MITRE ATT&CK

Technique T1548

Mitigation M1048).

2. NIST Special Publication 800-53 Rev. 5

Security and Privacy Controls for Information Systems and Organizations: Control CM-7

"Least Functionality

" advocates for configuring systems to provide only essential capabilities. A key implementation of this principle is "the use of application allowlists... to ensure that only authorized software is allowed to execute." This control directly mitigates the threat of legitimate tools being used for unintended

malicious purposes. (Source: NIST SP 800-53 Rev. 5

Control: CM-7

Page 133).

3. Cybersecurity and Infrastructure Security Agency (CISA): In guidance on protecting against malicious activity

CISA consistently recommends application control as a high-priority defense. For example

in the "Joint Cybersecurity Advisory on Russian State-Sponsored Cyber Actors

" CISA recommends organizations "Implement application allowlisting" as a mitigation against actors who leverage legitimate remote access tools and other LOLbins. (Source: CISA Alert AA22-110A

Mitigations Section).

The output in Tab 1 displays a list of files and their corresponding MD5 hash values. In Windows PowerShell, the Get-ChildItem cmdlet gets the items in a specified location (in this case, the current directory), and the pipe | sends that output to the Get-Filehash cmdlet. The -Algorithm MD5 parameter specifies that the MD5 hashing algorithm should be used. The resulting output format perfectly matches what is shown in Tab 1.

The output in Tab 2 shows active TCP connections, including local and foreign addresses, state, and the process ID (PID). Critically, it also lists the executable file name (e.g., [sftp.exe]) below each relevant connection. The netstat command is used to display network connections. The -b switch displays the executable involved in creating each connection, and the -o switch displays the owning process ID. The combination netstat -bo produces the exact format seen in Tab 2.

To identify the malicious file, we must correlate information from all tabs.

File Integrity Check: First, compare the current file hashes from Tab 1 with the known-good baseline hashes from Tab 4. The MD5 hash for cmd.exe in Tab 1 (372ab...) does not match the baseline hash in Tab 4 (a2cde...). This indicates the cmd.exe file has been modified or replaced.

Network Activity Analysis: Next, examine the network connections in Tab 2. The modified cmd.exe file is shown to have an established outbound connection to 192.168.10.37:http. The Windows Command Prompt (cmd.exe) should not be making persistent outbound network connections, making this behavior highly suspicious and indicative of data exfiltration or command-and-control (C2) communication.

The combination of a failed integrity check (mismatched hash) and suspicious network activity makes cmd.exe the file responsible for the malicious behavior.

Microsoft. (2023). Get-FileHash. Microsoft Docs. Retrieved from docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/get-filehash. (This official documentation describes the cmdlet used to generate the output in Tab 1.)

Microsoft. (2021). Netstat. Microsoft Docs. Retrieved from docs.microsoft.com/en-us/windows-server/administration/windows-commands/netstat. (This document details the netstat command and its parameters, such as -b and -o, which produce the output seen in Tab 2.)

Hogben, G., & Plohmann, D. (2016). Threat Landscape and Good Practice Guide for Smart Home and Converged Media. European Union Agency for Network and Information Security (ENISA). p. 28. (This report discusses how attackers replace legitimate system files, like cmd.exe, with malicious versions to establish persistence and create backdoors, aligning with the observed hash mismatch.)

Tanenbaum, A. S., & Wetherall, D. J. (2011). Computer Networks (5th ed.). Pearson Education. p. 657. (This textbook explains the TCP/IP protocol suite and connection states, providing the foundational knowledge to interpret netstat output and identify unusual established connections like an HTTP connection from cmd.exe.)

A thorough analysis of the provided logs reveals a clear sequence of a security incident.

1. Suspicious Activity: The SFTP log shows the external IP address 41.21.18.102 successfully logging in using the sjames account at 23:01:50. Immediately after, at 23:02:25, this IP writes to the index.html file, which directly corresponds to the website being "maliciously altered." The netstat log corroborates this by showing an ESTABLISHED connection from 41.21.18.102 to the local machine on port 22 (the standard port for SFTP/SSH).
2. Indicator of Compromise (IoC): The most direct evidence of the website defacement is the log entry showing the unauthorized modification of the primary web page. Therefore, the modified index.html file is the key IoC. The 404 errors from other IPs are less critical than a confirmed malicious file write.
3. Corrective Actions: The incident response must focus on containment and eradication.

• Changing the password for the sjames account is the immediate containment action to revoke the attacker's access.
• Deleting the sjames account is a necessary eradication step, ensuring this specific compromised asset can no longer be exploited. This action follows the initial password change to ensure the account is fully removed.

Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer Security Incident Handling Guide (NIST Special Publication 800-61 Rev. 2). National Institute of Standards and Technology.

Page 20, Section 3.3.2 (Containment): Recommends actions such as "changing passwords" for compromised accounts as a primary containment strategy.

Page 23, Section 3.3.3 (Eradication and Recovery): Discusses eradication, which includes "deleting user accounts" that were used in the attack.

Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson.

Chapter 3, Section 3.5.2: Explains the TCP connection states, including ESTABLISHED, confirming that the netstat output shows an active, two-way connection between the server and the attacker's IP address (41.21.18.102).

Al-Harbi, M. (2020). A Framework for Detecting and Analyzing Web Defacement Attacks. IEEE Access, 8, 185672-185689. https://doi.org/10.1109/ACCESS.2020.3029981

Section III-B, Table II: Lists "Unauthorized file modification" as a primary Indicator of Compromise (IoC) for web defacement attacks, validating the selection of the "Modified index.html file" as the key indicator.